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SUMMARY 


Expert system techniques, a major application area of artificial intelligence 
(AI), are examined in the development of a pilot associate to handle aircraft 
emergency procedures. The term "pilot associate" is used to describe research 
involving expert systems that can assist the pilot in the cockpit. The development 
of expert systems for the electrical system and flight control system emergency 
procedures are discussed. A simple, high-level expert system provides the means to 
choose which knowledge domain is needed. The expert systems were developed on a 
low-cost, FORTH-based package, using a personal computer. 


INTRODUCTION 


Project Background 

The increasing complexity of fighter aircraft is adding to the pilot workload. 
For example, during in-flight emergencies, the time available to take appropriate 
action can be limited, and the resulting pilot workload can be extremely demanding. 
An approach to reducing the pilot workload involves the development of a pilot 
associate using expert system technologies. 

This paper describes the results of a simple expert system development project 
for an advanced fighter aircraft. The goals of the research are as follows: 

1. To obtain a basic understanding of AI and the techniques used in 

expert systems . 

2. To obtain an understanding of the considerations required to develop 

an expert system for use in a critical application such as the 
pilot associate. 

3. To provide a simple expert system that can be operated on a widely avail- 

able personal computer and that will demonstrate some capabilities of 
the technology. 

Three expert systems were developed to assist the pilot in emergencies. The 
expert systems included the electrical system failure procedures (ELECXPRT) , the 
flight control system failure procedures (DFCSXPRT), and a third expert system 
(supervisor XPRT) to choose the appropriate knowledge domain. The expert systems 
were developed and run on a personal computer. The work was performed by a high 
school senior, with engineering assistance, under the Summer High School 
Apprenticeship Research Program (SHARP) during the summer of 1984. 

Background on Artificial Intelligence 

AI is a specialized field of computer science which concentrates on making com- 
puters "smarter." Hence, AI programs are capable of making deductions, inferences. 



and conclusions by evaluating the current or input problem state* This evaluation 
is based upon and guided by a knowledge base of known facts , rules , and procedures 
(refs* 1 to 3), * 

Four basic elements of AI are heuristic search, knowledge representation, com- 
monsense reasoning and logic, and AI languages and tools. 

The first element, heuristic search, is a search process used by the program 
to reach its conclusion. Early AI programs used blind (unguided) search methods. 
This tended to be inefficient and time-consuming. The problem worsened as the 
knowledge base was expanded to cover a larger domain. To combat this problem, 
heuristic search procedures were developed. The search process is quided by a spe- 
cial set of rules or instructions that narrow the search area and reduce solution 
time by guiding the search away from unfruitful solution paths. 

Knowledge representation, a popular area in current AI research, is con- 
cerned with structuring a knowledge base so that it is both efficient and 
easily expandable. 

The third area mentioned, commonsense reasoning and logic# is one of the most 
challenging in AI today. "Common sense" is believed to be low-level reasoning 
based on vast experience. The problem facing many AI researchers today is how to 
produce a system that learns what to anticipate as the result of an action. A 
similar concern is formulating how to deduce something from a large set of facts. 

The last element of AI is that of special languages and tools needed for in- 
telligent applications. Because of the nature of AI, conventional languages such 
as FORTRAN and BASIC, do not provide the performance capabilities necessary for AI 
applications. For this reason, a new generation of computer languages was deve- 
loped. The two most widely used are LISP and PROLOG. Nevertheless, the basic 
techniques used by AI programs are based on conventional mathematics: predicate 

calculus, logic, and proofs. 

There are also four major areas of AI applications: natural language 

processing (NLP), computer vision, expert systems, and general problem-solving 
and planning. 

NLP focuses on developing systems with computer-based speech understanding, 
text understanding, and the generating of speech and text. 

Computer vision involves enabling a computer to "see", to identify or 
understand what it sees, or to locate particular items. 

Expert systems research concentrates on making a computer perform as if it 
were an expert in a f specific domain. The primary goal is to develop a system which 
can solve problems with at least the same speed and quality as a human expert in 
that field. 

In general problem-solving and planning, the emphasis is on developing systems 
to solve problems for which there are no known human experts. In many cases, the 
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solution and planning techniques learned in the development process are as impor- 
tant as the final product. 

These aspects of AI programming distinguish it from conventional programming. 
The major differences between the two are listed in table 1 . 


NOMENCLATURE 


AFTX 

advanced fighter technology integration 

AI 

artificial intelligence 

BATT FAIL 

battery failure 

DFCS 

digital flight control system 

DFCSXPRT 

digital flight control system expert 

ELEC SYS 

electrical system 

ELECXPRT 

electrical system expert 

EPU 

emergency power unit 

EXPERT-2 

title of expert system development tool 

FC FAIL 

flight control failure 

FLT CONTL SYS 

flight control system 

FORTH 

fourth-generation programming language 

IBU 

independent backup unit 

MAIN GEN 

main generator 

MPD 

multipurpose display 

NLP 

natural language processing 

PMG 

permanent magnetic generator 

SHARP 

summer high school apprentice research program 

XPRT 

high-level expert system 

Ap 

change in pressure 



EXPERT SYSTEMS 

The research project at the Dryden Flight Research Facility of the NASA Ames 
Research Center (Ames-Dryden) focused on a specific area of AI, the expert system. 
The typical expert system is divided into three distinct parts: the knowledge 
base, the control structure, and the global data base (fig, 1). The knowledge base 
contains the domain knowledge, usually in the form of rules, that the expert uses 
to reach its conclusion, A special set of inference rules to be used for deter- 
mining heuristic search patterns may also be included in the knowledge base. The 
control structure contains the center of the system, the rule interpreter, which 
is also called the inference machine or inference interpreter. The inference 
machine utilizes the rules found in the knowledge base to reach its conclusion. 

The inference machine also uses any applicable inference rules, in addition to any 
heuristics programmed into the control structure itself, to guide its search. The 
final segment of the expert system structure is the global data base where the 
system status is stored. The present state, the goal state, the initial state, and 
any deductions or inferences made by the interpreter are typical data which may be 
contained in the global data base. 

The specific expert system used in this project was a modified version of the 
EXPERT-2 system and is a FORTH-based program (refs. 4 and 5). This expert system 
is similar in structure to the basic system described previously. The primary dif- 
ference between the EXPERT-2 global system and a generic expert system is the data 
base. The EXPERT-2 program simply maintains, as its data base, two stacks that 
contain a list of statements known to be true and a list of statements known to 
be false. 


SYSTEM IMPLEMENTATION 

The expert systems developed are based on the advanced fighter technology 
integration (AFTI) F-16 aircraft used in research at Ames-Dry den. The AFTI F-16 
airplane is a highly modified F-16 used in a joint U.S. Air Force and NASA program 
to demonstrate the capabilities of various nonconventional flight modes. AFTI uses 
a three-computer digital flight control system with no mechanical backups. The 
electrical and flight control systems described in this report are unique to the 
AFTI F-16 aircraft. 


Electrical System Expert 

The first expert system, electrical system expert ( ELECXPRT ) , was designed 
to diagnose A^TI F-16 electrical system failures. The initial step toward 
implementation was to gain an understanding of the operation of the aircraft 
electrical system. 

Electrical power is supplied by a primary generator, an emergency generator 
which is part of the emergency power unit, and two batteries. In case of a primary 
generator failure, backup power is provided by the emergency power unit (EPU), 
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which is powered by bleed air from the engine. If bleed air is not sufficient, EPU 
operation is augmented by hydrazine fuel. 

The EPU consists of an emergency generator and a permanent magnetic generator 
( PMG ) . If the emergency generator fails, reduced power is still supplied by the 
PMG. In case of a total generator failure, the aircraft can still be powered by 
either of the two batteries. 

The ELECXPRT uses as its inputs the same failure indications given to the 
pilot: a MAIN GEN failure light, an EMER GEN failure light, an EPU RUN light, a 

BATT FAIL-1 light, and a BATT FAIL-2 light. These inputs are obtained from the 
user by asking questions on the computer screen. In a real aircraft application, 
the failure lights would be monitored. 

The knowledge base was derived from the AFTI flight manual. From these data, 
the ELECXPRT determines the proper emergency procedures to be followed and displays 
this information to the user. 

In some instances, the ELECXPRT prompts the user for more information regarding 
the failure state, and gives the subsequent procedural information according to 
these responses. 

The rule base, which the ELECXPRT uses to make its conclusions, was compiled 
from the same procedural information in the AFTI flight manual (ref. 6) used by the 
pilot (fig. 2). 

Digital Flight Control System Expert 

The DFCS provides control of the aircraft through its three digital computers; 
there are only electrical links to the control-surface hydraulic actuators. The 
DFCS and its interfaces to the aircrafts sensors, controllers, and control surface 
actuators are shown in figure 3. 

An analog independent backup unit (IBU) is implemented in each of the three 
digital computers. These three IBUs provide safe operation of the aircraft in the 
event of a common mode failure of the three primary digital computers. 

The DFCS has the ability to identify failures in any component (sensors, com- 
puters, or actuators) for each of its three channels. The fault indications given 
to the pilot include cockpit failure lights and a message printed on the cockpit 
multipurpose display (MPD) • The MPD gives detailed information regarding which 
DFCS component has failed, how many have failed, and which aircraft control axes 
are affected. 

The DFCSXPRT uses as its input the DUAL FC FAIL light, the IBU light, the first 
line of the MPD fault page, and the device identification (DID) number displayed 
on the second line of the MPD. Again the information is obtained by posing them as 
questions to the user. As with the ELECXPRT, the DFCSXPRT provides the user with 
emergency procedures to be followed in a given failure state and occasionally 
requests additional information. Some of the procedural information, taken from 
the flight manual, is given in figure 4. 
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In addition to the expert system itself, a special user interface was designed 
for the DFCSXPRT. This routine employs information from the user to determine the 
truth value of a special set of rules before control is passed to the inference 
machine. This capability allows MPD text to be entered into the DFCSXPRT in addi- 
tion to answering the yes-and-no questions presented by it. 


Supervisor Expert 

After development of ELECXPRT and DFCSXPRT, a third expert program supervisor 
XPRT was written. This is an expert program which oversees the other two expert 
systems (fig. 5). It decides whether ELECXPRT or DFCSXPRT is better equipped to 
handle the fault diagnosis. This determination is based on the evaluation of the 
MASTER CAUTION, FLT CONTL SYS, IBU, and ELEC SYS lights. The supervisor XPRT was 
designed so that future expert programs could be incorporated by adding the 
necessary rules and routines for accessing such programs. 

In designing the expert systems, it was necessary to account for inconsisten- 
cies and highly unlikely failure conditions which were not specifically discussed 
in the AFTI flight manual. Evaluation of such conditions resulted in a more exten- 
sive list of possible failures and proper emergency procedures. An expert system 
is of particular value in such situations. An expert can give the pilot infor- 
mation regarding conditions not specifically covered by the flight manual, which 
could mean the difference between a possible solution and further deterioration of 
a failure state. 


DISCUSSION 


Three major observations should be mentioned. They concern knowledge engi- 
neering, the interfacing of an expert system to the aircraft system, and qualifying 
the expert system. 

Knowledge engineering is the gathering of the facts for the expert system 
and compiling them into a form suitable for the inference machine. For example, 
three iterations of the rule base for the electrical system occurred during its 
development. The primary reasons were to become familiarized with the expert 
systems format and to understand the electrical system. The rules to cover 
rare failure conditions that were not provided in the flight manual resulted in 
one of the iterations. The ELECXPRT was designed to cover all possible failure- 
light conditions. 

Interfacing the expert to the aircraft systems is discussed from more of a 
functional aspect than a physical one. Using the ELECXPRT as an example, three 
levels of system abstraction may be defined. The first is raw data such as the 
voltage output level of the primary generator. From this, the next level of 
abstraction — information — is obtained. For instance, the information could be 
that the primary generator has failed and would be derived from a combination of 
raw data and the knowledge of the designer. 
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The third level of abstraction isP more difficult to catagorize but could be 
called performance. Performance is derived from th@ knowledge of the aircraft 
system as a whole. For example, with a primary generator failure, the performance 
or capability of the aircraft can be derived by certain expert knowledge. The 
pilot procedures also are derived by this knowledge. The expert system described 
here contains the knowledge to develop the third level of abstraction (performance) 
from the second level of abstraction (information). It is not based on any raw 
data and assumes that the knowledge given by the designer is correct. The proce- 
dures give resulting performance capability; for instance, that only 15 min of 
aircraft control remain or that the amount of remaining battery time is low. 

Although the ELECXPRT is a very simple example, it raises the question of how 
extensive the knowledge of an expert system must be to assure accurate results. 

With a DFCS , this becomes a trade-off between the knowledge designed for storage in 
the expert system and the knowledge designed into the digital flight control system 
using conventional techniques. For example it is necessary to know what role 
should an expert system have when detecting, and reconfiguring for failures. 

The problem of qualifying large expert systems for proper operation is another 
major concern. The approach used here is the same as that for the software quali- 
fication of flight-critical control system software. Each of the experts is small 
enough in its domain of knowledge so that it can be accurately qualified. The 
individual experts must then be integrated together and qualified as a whole. The 
qualification for the ELECXPRT, for example, required 54 test conditions. In each 
test, the expected results were identified before the test was run. The test 
results were then compared with the expected results. The final step in the pro- 
duction of the XPRT system was this software verification. 


CONCLUDING REMARKS 


An overview of the field of artificial intelligence (AI) was obtained. The 
goal to acquire a basic understanding of the concepts behind expert systems and 
their applications was also accomplished. Three expert systems were developed on a 
personal computer to assist an aircraft pilot in cases of emergency. These systems 
included one for electrical failure procedures, another for flight control system 
failure, and a third to oversee or supervise the choosing of the appropriate knowl- 
edge domain. The electrical system expert (ELECXPRT) was capable of handling all 
possible failure conditions and qualified completely. The DFCS expert (DFCSXPRT) 
was capable of handling both binary yes-and-no cases and text strings to determine 
proper pilot procedures. The expert system also provides emergency procedures for 
low-probability failure conditions that are not covered by the flight manual 
(ref. 6). 



Applying the expert system technology to a simple pilot associate provided 
hands-on experience essential for good understanding. It is hoped that this expert 
system will demonstrate the value of a real-time application of expert system tech- 
nology in a flight environment. 


Ames Research Center 

Dry den Flight Research Facility 

National Aeronautics and Space Administration 

Edwards, California , October 11, 1984 
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TABLE 1. - COMPARISON OF AI WITH CONVENTIONAL PROGRAMMING 


AI Programming 

Conventional Programming 

Primarily symbolic 
Heuristic search (solution 
steps implicit) 

Control structure separate 
from knowledge domain 
Easy to modify , update, and 
enlarge 

Primarily numeric 

Algorithmic (solution steps 
explicit) 

Information and control integrated 
together 

Difficult to modify , update, or 
enlarge 
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(a ) Basic expert system . 


( b ) EXPERT-2 system. 


Figure 1. Expert system structures. 


CAUTION LIGHT ANALYSIS 


ELECSYS 


BATT FAIL 1 
LIGHT ON 


MAIN GENERATOR 
OFF THE LINE. 
EMERGENCY 
GENERATOR 
OPERATING, EPU 
RUN LIGHT ON 


A/C BATTERY NO. 1 
SYSTEM HAS FAILED 


CHECK ELECTRICAL 
PANEL FOR ILLUM- 
INATED LIGHT(S) 
AND RESET 
CAUTION LIGHT 


CAUTION LIGHT 
ON AND IS 
JT RESETTABLE , 


SEE F&G 


BATT FAIL 2 
LIGHT ON 


GEN MAIN AND 
EMER LIGHTS 
ON. EPU RUN, 
AIR (AND 
POSSIBLY 
HYDRAZINE) 
LIGHTS ON 


GEN MAIN, 
EMER 

LIGHTS ON; 
EPU RUN 
LIGHT OFF 


A/C BATTERY NO. 2 
SYSTEM HAS FAILED 


MAIN AND EMER 
GENERATORS INOP- 
ERATIVE. PMG IS 
OPERATING 


MAIN, EMER, PMG 
INOP 

AIRCRAFT BAT- 
TERIES SUP- 
PLYING FLT 
CONTROLS AND 
POWERING 
BATTERY BUSES 


GEN MAIN AND 
EMER LIGHTS 
ON, EPU RUN 
LIGHT OFF, 
BATT FAIL 1 
OR BATT FAIL 
2 LIGHT ON 


MAIN, EMER GENER- 
ATORS, PMG AND 
A/C BATTERY 1 OR 
I 2 FAILED. 

REMAINING BATTERY 
IS POWERING 
FLIGHT CONTROLS 


(IF FLIGHT 
CONTROLS I 


CONTROLS RESPOND) 
AND BATTERY BUS 
OF UNFAILED 
BATTERY. 


LAND AS 
SOON AS 
POSSIBLE 


NOTE: 

• IF BATT FAIL 1 LIGHT ON - NO COMMUNICATIONS 

• IF BATT FAIL 2 LIGHT ON - NO BRAKES FOR STOPPING 
OR STEERING AIRCRAFT, NO TAIL HOOK, NO PARKING 
BRAKE 


Figure 2. Example of caution-light analysis flow 
diagram (from ref. 6). 
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CAUTION LIGHT 

CAUSE 

CORRECTIVE ACTION /REMARKS 

ELEC SYS 
Check ELEC panel 
fault lights and 
reset caution 
light 



GEN MAIN light 

Main generator 

A. Attempt reset 


failure 

1. MAIN PWR switch - BATT, 
then MAIN PWR 

If main generator resets 

2. EPU knob -OFF, then AUTO 
If main generator does not reset 

3. MAIN PWR switch - MAIN 
PWR (verify) 



4. Monitor fuel balance 

5. Monitor Hydrazine quantity 



6. Land as soon as possible 
NOTES 

• GEN MAIN light indicates 
electrical power to nonessential ac 
and dc buses lost 

• EPU furnishes electrical power for 
both essential ac buses 

• Refer to MAIN GENERATOR 



FAILURE 

BATT-FAIL 1 1 

A/C battery 

B. 

light 

system No. 1 

1. EPU knob -ON (When flight 

i 

failure 

conditions permit) Check EPU 
run light 

If EPU runs abnormally 

2. EPU knob - Cycle to OFF, then 
AUTO. 

3. Land as soon as possible 

NOTES 

• Refer to BATTERY SYSTEM 
FAILURES 

• Refer to LANDING WITH FIRED 
EPU 

BATT-FAIL 2 

A/C battery 

C. Same as B except as noted: 

light 

system No. 2 i 

NOTE 


failure 

J 

• If main generator also fails, no 
electrical power available to start 
EPU. 


Figure 2 * Continued * 




CAUTION LIGHT 

CAUSE 

CORRECTIVE ACTION /REMARKS 

ELEC SYS 
GEN MAIN and GEN 

Failure of both main 

D. 1. MAIN PWR switch - BATT, 

EMER lights (EPU 

and emergency 

then MAIN PWR 

RUN light on) 

generators 

If main generator resets 



2. EPU switch (knob) - OFF, 
then NORM (AUTO) 

If main generator does not reset 
and EPU is on 

3. MAIN PWR switch - MAIN 
PWR (verify) 

4. Land as soon as possible 

NOTES 

• Only FCS and equipment 
connected to battery buses will 
function 

• PMG operation indicated by EPU 
RUN light on. 

Total Generator 


• Refer to MAIN AND EMERGENCY 
GENERATOR FAILURE (PMG 
OPERATING) 

E, Refer to TOTAL GENERATOR 

Failure GEN MAIN, 


FAILURE 

GEN EMER 


NOTES 

(EPU RUN LIGHT 


• PMG failure indicated by no EPU 

OFF) 


RUN light ', 

No ELEC panel fault 


F. Push CAUTION RESET button 

lights 


on electrical panel 

(ground operation) 


* If light stays on with main 

Steady ELEC SYS 


generator on line - notify 
maintenance 

• If light goes off - notify 
maintenance 

G. On the ground - notify 

light (not 


maintenance; in flight -refer to 

resettable) 


ABNORMAL EPU OPERATION, this 

(EPU RUN LIGHT 


section. 

OFF) (Any combina- 



tion of ELEC panel 



fault lights 



possible) 




Figure 2 . Concluded 





Figure 3. Digital flight control system . 


CAUTION LIGHT 


FLT CONTL 
SYS 


CAUTION LIGHT ANALYSIS 


CAUSE 


CORRECTIVE ACTION/REMARKS 


• Single DFCS Fault 

• Single IBU Fault 

• GBIAS/INU Error 


A. Consult FCS FAULT page to determine reason for light. 
D&R RESET OSS. Light will extinguish. If RESET 
successful, message will disappear from MPD. No single 
DFCS fault will produce any change in aircraft 
performance 

B. If GBIAS/OFF appears on the MPD, verify that INU 
attitude data is good and D&R GBIAS OSS. RESET 
successful if GBIAS/INU appears on MPD 



Figure 4. Example of caution-light analysis procedure for 
flight control system (from ref. 6). 






















DUAL LIKE FCS FAILURE 
2 identical failures out 
of 3 possibilities 


(DID 1-39) 
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WARNING LIGHT ANALYSIS 



Figure 4 • Concluded • 



Figure 5. Relationship of three expert 
systems with potential for future addi- 
tional expert systems • 
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